Is a 6 digit numerical password secure enough for online banking?

Question

My bank went through a major redesign of their customer online banking system recently. The way security is managed across the platform was also reviewed. The password I am able to set now to log in is forced to be 6 digits long, numerical.

This goes a long way against what I thought to be a secure password policy. On the other hand, I trust my bank to know what they are doing.

Could you help me understand how good this policy is?

• Compared to common practices in the sector.
• From a more general IT security point of view.
• As a customer: How much should I be worried that my account may be easy to compromise?

Notes:

• The user is id card number, which is almost public data.
• Someone entering my account is still not able to make a payment before it goes through another security mechanism (which we will assume to be good).

Answer 1

A 6 digit numerical password doesn't do much.

Why 6 Digits?

Troy Hunt has an excellent blog about being forced to create weak passwords where he talks about various bad practices including forcing short numerical passwords and puts forward the often used excuse that

“We want to allow people to use the same password on the telephone keypad”

The only valid reason to require a numerical only password is that the only input available to a user is numerical (e.g. with ATMs); (similarly the only valid reason to require a human readable password is that a human will read it - which would be a very bad sign if it was used not just for telephone banking, but for the website too).

But if that is the reason, why on earth would they force you to use the same insecure pass code online (or on mobile), when you have access to a full qwerty keyboard?

How easy to brute force the way in?

There are 10⁶ possible passwords consisting of 6 digits.

For an unskilled attacker, getting into your account is no problem at all if they have your username and unlimited attempts. You should assume they have your username. Usernames are not secrets.

Let's maybe assume the bank has thought of this, and locks each account after 3 bad tries, or perhaps initiates a robot-limiting option like a captcha to try again after that. Then the attacker still has a 3/1000000 chance of getting in to a random account within that window.

That means if they attack 1000000 accounts, they can expect to get into 3. And making 3000000 requests would not take very long at all.

Compare that to how many passwords there are with 6 alphanumeric characters (by most security standards, far too short, and not complex enough).

There are 62⁶ = 56800235584 possible 6 character alphnumeric passwords. That's still too weak but it's already 56800 times stronger!

Stored securely?

Needless to say, if the user database was breached, 10⁶ possible passwords is ridiculously low entropy, and whatever hashing and salting system they've used, they can't keep your passcode secure.

Your bank's plan in the case of a database breach is presumably to roll over and cry. Maybe they think the outcome is so bad they just aren't going to plan for it.

Assuming the other authentication method is secure, should I worry?

An attacker seeing your finance history is a really big issue; you should be worried even if the other authentication method blocking transfers is secure. And you should not expect the other method to be secure.

How much other information is leaked about you without the 2nd authentication method? Your name, address, email, maybe?

These are more than enough to start doing background research on you, to get additional info - these could be clues to your other password, or good strong information on how to phish you. They might try calling you, using the information they have on you so far to gain your trust, pretending to be the bank, and trick you into revealing other secrets about yourself under a ruse that you need to authenticate to them by answering the last few questions they need in order to get into your account.

As another example, if the 2nd authentication method is a strong password, but you (and for most customers the "you" isn't tech savvy) but the customer happens to have ever been included in a database breach for another website where they used the same username/email and password, then its game over. - This logic applies to any username/password based system, but is particularly relevant in this case because the attacker is able to discover other information about you exposed by the first insecure authentication method, and because the 2nd password is now the only barrier to them taking your money - this is one reason why industry standard is to require a 2 factor authentication on banking websites before showing the user anything.

As for industry standards; my bank have an no max length password with the ability to take special characters, and then follow it up with a 2nd passcode which can only be entered by selecting some letters from a series of drop downs (so the entire 2nd passcode isn't used in a single attempt).

I'd prefer it if my bank used an out of band 2nd authentication factor; such as a code being sent to my phone.

Answer 2

Unusual? Yes. Crazy? No. Read on to understand why...

I expect your bank has a strong lockout policy, for example, three incorrect login attempts locks the account for 24 hours. If that is the case, a 6-digit PIN is not as vulnerable as you might think. An attacker that tried three PINs every day for a whole year, would still only have about a 0.1% chance of guessing the PIN.

Most websites (Facebook, Gmail, etc.) use either email addresses or user-selected names as the user name, and these are readily guessable by attackers. Such sites tend to have a much more relaxed lockout policy, for example, three incorrect logins locks for account for 60 seconds. If they had a stronger lockout policy, hackers could cause all sorts of trouble by locking legitimate people out of their accounts. The need to keep accounts secure with a relaxed lockout policy is why they insist on strong passwords.

In the case of your bank, the user name is a 16-digit number - your card number. You do generally keep your card number private. Sure, you use it for card transactions (online and offline) and it is in your wallet in plaintext - but it is reasonably private. This allows the bank to have a stronger lockout policy without exposing users to denial of service attacks.

In practical terms, this arrangement is secure. If your house mate finds your card, they can't access your account because they don't know the PIN. If some hacker tries to bulk hack thousands of accounts, they can't because they don't know the card numbers. Most account compromises occur because of phishing or malware, and a 6-digit PIN is no more vulnerable to those attacks than a very long and complex password. I suspect that your bank has no more day-to-day security problems than other banks that use normal passwords.

You mention that transactions need multi-factor authentication. So the main risk of a compromised PIN is that someone could view your private banking details. They could see your salary, and your history of dodgy purchases. A few people have mentioned that a 6-digit PIN is trivially vulnerable to an offline brute force attack. So if someone stole the database, they could crack your hash, and get your PIN. While that is true, it doesn't greatly matter. If they cracked your PIN they could login and see your banking history - but not make transactions. But in that scenario they can see your banking history anyway - they've already stolen the database!

So while this arrangement is not typical, it appears that it is not so crazy after all. One benefit it may have is that people won't reuse the same password on other sites. I suspect they have done this for usability reasons - people complained that they couldn't remember the long, complex passwords that the site previously required.

Answer 3

Original answer

This is a bad, bad policy. There are only 10⁶ or a million different 6-digit numbers. That is so too little.

It is almost impossible to prevent an offline brute force attack, no matter how slow a hashing algorithm you use. If one attempt takes 1 second, you will crack a password in 11 days. It may also be too little to completely stop a clever online brute force attack, if the attacker can use multiple IPs (say, from controlling a botnet) and has many different card numbers to try on.

This is made worse by the fact that, just like with ordinary passwords, most people don't pick them at random. 123456 is bound to show up a lot, and so are numbers that represent dates. In practice, most passwords will have much less than 6×log₂(10) ≈ 20 bits of entropy.

I can see no reasons why you should not be allowed to pick a stronger password. This practice sends the signal that they simply do not care about security. It also makes me suspect that somewhere in their database there is a NUMBER(6) instead of a hash stored.

That payments can't be done without another factor of authentication is a bit comforting, but not much. An attacker could still see your account history, something that could contain very sensitive information and also be used for phishing.

Even if this will probably never be used against you, if I were you, I would consider switching to a new bank. Preferably one that requires two-factor authentication at login.

Further comments

There has been some discussion in comments and some good answers with another view has popped up, so I would like to elaborate and respond to some critiques.

But the usernames are secret!

According to the question, the ID card numbers (not to be confused with credit card numbers) are "almost public", and OP has clarified in comments that he has seen lists of them as "results for public sector services". In other words, the usernames are not secret. And they should not have to be – if the security of your system rests on the fact that the usernames are secret, you are doing it wrong.

Rate limit per account and/or IP number will take care of this.

A distributed brute force attack, e.g., using a botnet, would have a decent chance to break a few accounts. Let's say you have 10 000 computers, and each computer tests 3 passwords per day during a month on different accounts. That is about 10⁶ attempts. That will give you one account on average if the passwords are truly random. In the real world, you will get much, much more.

Sure, the bank could theoretically have some sophisticated system to detect and defend against attacks like this. Maybe, maybe not. As a customer, I have no way of knowing, and I certainly do not trust an organisation that can't even get the password policy right to do anything more advanced.

An offline attack is irrelevant. If the passwords are out, so are the sensitive data they are protecting.

Maybe, maybe not. There are plenty of data dumps floating around the Internet with incomplete data. To claim that the passwords will be forever glued to your account history makes some very strong assumptions on how the breach happened and how the data was handled afterwards.

Your credit card PIN is only four digits, so what does it matter anyway?

Your credit card PIN is one weak factor in a two-factor authentication. The other factor – possession of the card – makes the system stronger.

This password is a weak factor, and it is also the only factor protecting your financial information.

Conclusion

To be clear, I am not saying it would be impossible for a bank to make this system secure with other means. I am not saying a successful attack on anyone's account is likely, even less so on yours specifically. What I am saying is that this is not "secure enough" for a bank.

The bank has already gone through the trouble of setting up two-factor authentication for financial transfers. Why not just use it for logins as well?

The bank has (hopefully) already gone through the trouble of hashing a password and storing it in a database. Why not just remove the part of the code that limits the password to six digits?

Answer 4

Contrary Opinion: Beware

It is highly likely that you as the user have not been made aware of other security measures put in place by your bank in front of your PIN. I know that as for CapitalOne360, which has a similar 4 - 6 digit pin system, I was shocked! But after a while of using the PIN on the same computer, I finally needed to login on an alternate machine (different IP, different browser). When I had done this, it had actually asked me for a password. Not only this, but then after I had successfully entered the password it also requested my PIN as a bonus.

After some research, I discovered that the browser only asks for a password when the user first visits the website and receives some sort of authentication cookie. Once the user account is trusted on that machine's IP/Cookie combination, it then allows passwordless, PIN-only logon. But the first time the user logs in, they ARE required to enter a password. You may just be unaware of the practice (as I was).

I find it incredibly unlikely that a bank which already has a functional working password system would completely bin it for a 6-digit only, numerical PIN number. Companies may perhaps seem stupid, but considering that a 6-digit authentication breaks common sense, as well as PCI standards, I sincerely doubt this is the only authentication present. Perhaps the original poster can shed additional light on this in case I missed something.

Answer 5

Is a 6 digit numerical password secure enough for online banking?

No, it is not, not just because of ability of a malicious user to break such an authentication mechanism, but because it violates PCI-DSS compliance standards and the FFIEC guidance on authentication. In addition, multi-factor authentication has been required by FFIEC guidance since 2006.

I'm pretty sure you are missing something in your examination of your web site-- i.e. there may be additional factors of authentication that only kick in under certain circumstances, e.g. if you change your device or IP address. Either that, or you're not actually writing about a real online banking web site, but some third party financial assistance site (which I would probably stop using if I were you).

Answer 6

I'm going to take a contrarian stance, and say yes, it's secure enough, for a bank.

1. Banks usually have lots of money to recover from breaches
2. Banks usually have lots of influence with the government, and can avoid class-action lawsuits (I'm from Canada, and we have only a few, large banks)
3. Banks have lots of customers, and fewer support calls = more money in their pockets
4. Banks usually run on old mainframes, which are expensive to update
5. Banks usually have fraud detection software analyzing all transactions

So, it's not a question of absolute security, it's a question of whether this password policy is profit-maximizing. In most Western countries, the directors of the bank are legally required to maximize profit for the shareholders.

From a customer perspective:

I don't recommend trying to brute-force your own password, but if you did, you'll (hopefully) notice an account lockout after 3-5 attempts. This reduces the effectiveness of brute-force attacks.

With my bank, I am asked security questions if I login from a computer I have not logged in with before. So a hacker, on a different computer, would have to guess the password, and know the answer to the security question.

If you're a consumer, your government hopefully provides consumer protection resulting in a return of your money if there's fraud.

Answer 7

Compared to common practices in the sector, your conditions are not that unusual. My bank has similar policies, with two notable differences:

• the username is NOT my card number. I have received it by mail in a protected envelope, similar to one they used to send my PIN. It's not a real secret though, it can be found on some of the statements as well.

• my password is numerical with 6 digits MINIMUM (up to 10 digits I believe). But I use a 6-digit pin nevertheless.

My online banking account also gets locked after 3 failed login attempts, so I'm pretty confident it won't get brute-forced. I suppose your bank has the same policy; you may want to read your contract or verify to be sure. I have never been denied the access to my account except that one time I forgot one of the digits and tried to brute-force it.

Answer 8

It seems like weak security, but in reality a brute force hack is not feasible for online banking.

Banks use very robust fraud detection systems, and very rigorous monitoring. Account lockout typically requires a phone call to re-activate, unlike many other online systems which simply use a time-based lockout.

They will also almost certainly be using anti-forgery tokens in the login form, so you cannot simply fire post requests at the end-point and expect them to work. Realistically you would be limited to browser automation hacking, which will slow things down considerably, and require a lot more complex programming to setup. Many online banking sites also use randomly generated keypads, so your automation script would need to be able to do OCR to recognize which keys to press.

So, in practice, the short pin length isn't quite the glaring security failure that others are suggesting.

Brute force typically is not how online accounts are compromised anyway. Phishing and social engineering are the preferred methods, and pin length/complexity will not help prevent this.

Answer 9

If as you pointed in notes:

Someone entering my account is still not able to make a payment before it goes through another security mechanism (which we will assume to be good).

Then it is likely that the only thing the 6-digit password protects is the account balance and history.

For comparison: my Japanese bank sends me my account history printed, in a regular mail. My mail box is unprotected and anyone can retrieve the letter.

So a 6-digit password (possibly with a retry limit and timeout) seems like an improvement.

Answer 10

it is not secure enough from global point of view. Think to have system trying to log to 100000 accounts, using one password number. Why many banks rely on it, is above my undertstanding. Even viewing your account (without ability to withdraw any money) can actually make harm (address, ballance,...).

Another problem is that even locking your account can be kind of social engineering. It should not be possible to lock somebody elses account by typing 3/5 wrong passwords. It is not used much as such, but can do lot of harm or inconvenience. Think about somebody locking one else's account on purpose, then calling him "on bank behalf" for physhing reasons. Or just to anoy him (online revenge Etc.)

Answer 11

In the big picture it may actually be more secure.

When we computer people talk about security we talk about bit of entropy, hash algorithms, brute force attempts and the like. It's easy to forget one simple, unavoidable rule. People are stupid! All of that goes out the window when a user writes down their password, pin number, and security question/answer on a piece of paper, wraps that paper around their ATM card, and shoves the whole thing in their wallet. (Or puts their password on a yellow sticky note under the monitor.)

Using a single 6 digit password, in conjunction with multi-factor authentication, and a strong lockout policy is probably a lot better "in the big picture", then several more complex passwords.

Lets take an example:

Old Way:

A user sets up their account, then has to chose a card pin. They are told to use a number they can remember. Most people choose a date or combination of dates, or 1234.

The user is then asked to set a "security question and answer" for when they call in. They choose something like "What elementary school did you go to in 5th grade?"

The user is then asked to set a secure password on the website, but hates these things because they can never really remember a secure password so they set "sunsname123@" and the teller writes it down for them and the user shoves it in their wallet.

This is pretty standard practice. Pin numbers can be figured out by only needing to check a subset of the numbers that might be a valid date, in a few combinations. The security question is pointless, as it's public knowledge, and the password meets all the technical requirements or a "secure password" but isn't.

New Way:

A user sets up their account, and is asked to choose a 6 digit everything pin. They still choose one based on a date.

The user is then helped with, of given, or told to install a multi-factor authenticator (lets pretend a key fob for now).

Now no matter the transaction, be it ATM or in branch or over the phone, you can instruct the bank staff, and the customer, to provide/receive the PIN and the MFA code.

In the real world this probably presents less risk then the less security inclined people calling in once a week because they forgot their password, providing the public knowledge answer to their security question, resetting their password and writing it down AGAIN and sticking it in their wallets.

Answer 12

Almost, but not quite

It is "secure enough" in the sense that at first sight, it is highly unlikely (near impossible) that someone gets into your account at all and can access data such as e.g. your account balance, and insofar as it is even less likely (due to two-factor auth) that they will be able to make a transaction.

It is not secure enough insofar as it is trivially possible to feed random account numbers with random PINs (the exact format of the account number including check digits is publicly known information, this greatly limits the search space). Note how random-random is just what is the precondition for the birthday paradoxon, so luck is on the attacker's side.

Unless the bank blocks by IP address when triggering lockout (unlikely, but even so you can trivially run the attack from a botnet), their strong lockout policy is worth exactly nothing against this attack. You can test literally ten thousands of account/PIN combinations per second.

Yes, it is unfeasible to target you personally, and it is still kinda tedious to target someone, but targetting someone is not practically impossible, it is entirely doable without even breaking into the server and stealing the account database or such.

Now, if you consider the possibility of someone reading out your account balance and personal data and knowing your income as something you can live with (you don't have anything to hide, do you!), this is nevertheless a worrysome thing.

Not only do they now know who you are and where you live (and whether it's worth burgling your home or kidnapping your child), but also it is entirely possible given only the valid account holder's name and first name as well as the account number to direct debit you.
Sure enough, you can dispute the transaction -- if you get aware of it within 4 weeks. But if it escapes your attention, it's just bad luck for you. In either case, it's a lot of trouble.

Answer 13

Yes its fine, but only if its part of multi-factor authentication* and includes a system of side-channel verification on user actions**.

All less secure solutions are in my opinion not adequate in a modern internet bank and does not address infected computers, MIBs etc.

*For example that you have to vouch for the computer you are using, through your mobile phone.

**Such as each payment action are sent with a code to your mobile phone that also includes details on the payment action you are accepting.